禅道-ZenTao

禅道-ZenTao 项目管理 API 集成技能。支持查询产品、项目、执行、需求、任务、缺陷等。触发词：禅道、zentao、禅道查询、禅道项目

This skill appears internally consistent for integrating with a self-hosted ZenTao instance, but consider these practical cautions before installing: 1) Source/attribution is unknown and there is no homepage — if you rely on it in production, review the full read_credentials implementation and the code paths that log or print responses to ensure credentials are not inadvertently recorded. 2) TOOLS.md holds plaintext credentials — do not commit it to version control; prefer a token or scoped account and use HTTPS endpoints. 3) The code performs network requests to the endpoint you configure; verify you trust the ZenTao host and that credentials are rotated and limited in scope. 4) Action (create/update/delete) flows require interactive confirmation via input(); if you plan to run this non-interactively (as an autonomous agent) test how confirmation is handled so it cannot be abused to perform writes without explicit consent. 5) If you want higher assurance, run the package in an isolated environment, review the full source (especially any omitted helper functions), and confirm there are no hidden remote URLs or logging of secrets.

Type: OpenClaw Skill Name: yoyoalphax-zentao Version: 1.0.6 The ZenTao skill bundle provides a legitimate integration for the ZenTao Project Management system, allowing users to query and manage products, projects, tasks, and bugs via REST and legacy APIs. The code (lib/zentao_client.py, lib/zentao_rest_client.py) implements standard API client logic and handles credentials securely by reading them from the local TOOLS.md file as per OpenClaw conventions. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found, although the 'httpx' dependency is missing from the requirements.txt file.